[Bug 1844498] Re: 18.10+ cloud images have the LXD group as gid 1000

[Michael Hudson-Doyle]

On Thu, 10 Oct 2019, 23:41 Dimitri John Ledkov, <launchpad at surgut.co.uk>
wrote:

> This has now added
> lxd:x:101:
>
> Into ubuntu-base tarballs http://cdimage.ubuntu.com/ubuntu-
> base/daily/pending/ which is a bit problematic.
>
> Was that intended?
>

I think it was sort of known, vs actively intended.

core20 snap builds started to fail now, as it installs a few more
> packages on top of base, and expects to maintain stable gids
>

Ok. Making this hook not run for ubuntu-base seems ok to me. Can we make
autopkgtests fail in this case for next time?

>
>

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/1844498

Title:
  18.10+ cloud images have the LXD group as gid 1000

Status in cloud-images:
  New
Status in cloud-init package in Ubuntu:
  Invalid
Status in livecd-rootfs package in Ubuntu:
  Fix Released
Status in snapd package in Ubuntu:
  New

Bug description:
  The LXD group is meant to be a system group (< 1000).
  The logic in our deb and snap packages is to create it with --system.

  However, we've recently had a report that on cosmic and higher, the LXD group is at gid 1000.
  The lxd user itself isn't affected and is getting a system uid as expected.

  The image itself doesn't contain that group in /etc/group so it
  appears to be created on first boot.

  Some investigation made me think of this part of /etc/cloud/cloud.cfg:
     default_user:
       name: ubuntu
       lock_passwd: True
       gecos: Ubuntu
       groups: [adm, audio, cdrom, dialout, dip, floppy, lxd, netdev, plugdev, sudo, video]
       sudo: ["ALL=(ALL) NOPASSWD:ALL"]
       shell: /bin/bash

  As the group will only exist when the snap gets installed, it seems
  possible that cloud-init would be the one automatically creating the
  group in such case, wrongly creating it as a user group rather than a
  system group.

  The easiest way out of this would be to either have the image build
  process or cloud-init itself create it as a system group ahead of user
  creation.

     groupadd --system lxd

  This would then have cloud-init use the system group for the default
  user and the LXD snap will happily use the existing group too.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/1844498/+subscriptions